Stored XSS Vulnerability in Semantic MediaWiki by Semantic MediaWiki
CVE-2025-61682

8.6HIGH

Key Information:

Vendor

Semanticmediawiki

Status
Semanticmediawiki
Vendor
CVE Published:
18 September 2026

What is CVE-2025-61682?

Semantic MediaWiki, an open-source extension of MediaWiki, introduces a security risk through stored XSS. In affected versions, unsanitized data attributes are inserted directly into the Document Object Model (DOM) as HTML. This flaw could allow attackers to execute arbitrary scripts in the context of the user’s browser, leading to potential data theft or unauthorized actions within the wiki. Users are advised to upgrade to version 7.0.0 or later, which contains the necessary patches to mitigate this vulnerability.

Affected Version(s)

SemanticMediaWiki >= 3.1.0, < 7.0.0

References

https://github.com/SemanticMediaWiki/SemanticMediaWiki/se...
x_refsource_CONFIRM
https://github.com/SemanticMediaWiki/SemanticMediaWiki/re...
x_refsource_MISC

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.